SOC 2 template · Type I and Type II
Management's Description of the System
Section 3 of SOC 2 Type 2 report, mandatory narrative describing infrastructure, software, people, procedures, and data per AICPA Description Criteria DC 200 (2018 revision). Written for your company, citing the controls below.
- Sections
- 17
- Controls cited
- 3
- Formats
- PDF, Word
- Shelf
- 22 SOC 2documents in all
No card needed to start.
SOC 217 sections
Management's Description of the SystemSection 3 of SOC 2 Type 2 report, mandatory narrative describing infrastructure, software, people, procedures, and data per AICPA Description Criteria DC 200 (2018 revision).
- Cites
- PI1.1, CC2.1, CC2.3
- Formats
- PDF and Word
SOC 2 shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- System Overview and Background
- Services Provided and Scope of the Report
- Principal Service Commitments and System Requirements
- Infrastructure
- Software
- People
- Procedures
- Data
- System Boundaries
- Subservice Organizations
- Control Environment
- Risk Assessment Process
- Information and Communication Systems
- Monitoring Activities
- Complementary User Entity Controls (CUECs)
- Significant Changes During the Period
- Identified System Incidents
Controls it cites
The SOC 2 controls this policy is written to meet.
- PI1.1Processing Integrity: Processing SpecificationsSOC 2
- CC2.1COSO Principle 13: Information QualitySOC 2
- CC2.3COSO Principle 15: External CommunicationSOC 2
- SOC 29 sections
Management's Assertion
CitesCC4.1 CC5.3PDF · WordCites CC4.1, COSO Principle 16: Monitoring Activities (SOC 2); CC5.3, COSO Principle 12: Policy Deployment (SOC 2). - SOC 29 sections
Information Security Policy
CitesCC1.1 CC1.2 CC1.3 +6 +7PDF · WordCites CC1.1, COSO Principle 1: Integrity & Ethics (SOC 2); CC1.2, COSO Principle 2: Board Oversight (SOC 2); CC1.3, COSO Principle 3: Management Structure (SOC 2), and 6 more. - SOC 210 sections
Access Control Policy
CitesCC6.1 CC6.2 CC6.3 +5 +6PDF · WordCites CC6.1, Logical & Physical Access: Security Software (SOC 2); CC6.2, Logical & Physical Access: Credentials (SOC 2); CC6.3, Logical & Physical Access: Authorization (SOC 2), and 5 more. - SOC 27 sections
Password Policy
CitesCC6.1 CC6.2 ISO A.8.5 +3 +4PDF · WordCites CC6.1, Logical & Physical Access: Security Software (SOC 2); CC6.2, Logical & Physical Access: Credentials (SOC 2); ISO A.8.5, Secure Authentication (ISO 27001), and 3 more. - SOC 27 sections
Data Classification Policy
CitesC1.1 CC6.7 ISO A.5.12 +3 +4PDF · WordCites C1.1, Confidentiality: Identification (SOC 2); CC6.7, Logical & Physical Access: Transmission Security (SOC 2); ISO A.5.12, Classification of Information (ISO 27001), and 3 more. - SOC 28 sections
Acceptable Use Policy
CitesCC1.1 CC1.4 CC1.5 +3 +4PDF · WordCites CC1.1, COSO Principle 1: Integrity & Ethics (SOC 2); CC1.4, COSO Principle 4: Competence Commitment (SOC 2); CC1.5, COSO Principle 5: Accountability (SOC 2), and 3 more.
SOC 2 on its own
- Documents
- 22
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so SOC 2 + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.